CVE-2026-58166

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-58166
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58166.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-58166
Published
2026-06-30T15:51:20.900Z
Modified
2026-07-16T03:30:48.735510252Z
Severity
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
OpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete
Details

OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that allows unauthenticated remote attackers to write or delete arbitrary files by supplying a malicious multipart filename in the file upload endpoint. Attackers can send a crafted filename containing path traversal sequences or an absolute path to the POST uploads session endpoint, which constructs the destination path without sanitization in saveuploadfile, causing file write and cleanup operations to target attacker-chosen paths on the server filesystem.

Database specific 
{
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58166.json",
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/openbmb/chatdev

Affected ranges

Type
GIT
Repo
https://github.com/openbmb/chatdev
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3c72d860d2553f05129b7dff0fd4efdde5b01d2f
Fixed
4fd4da603801766b14ad8788649cfc1ad21f99a6
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.2.0"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.0.0
v2.1.0
v2.2.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58166.json"